Mahesh V. Tripunitara and Samuel S. Wagsta, Jr. COAST Laboratory. Purdue University. COAST TR-98/01.

Size: px

Start display at page:

Download "Mahesh V. Tripunitara and Samuel S. Wagsta, Jr. COAST Laboratory. Purdue University. COAST TR-98/01."

Rebecca Porter
5 years ago
Views:

1 The Compression Functions of SHA, MD, MD4 and MD5 are not Ane Mahesh V. Tripunitara and Samuel S. Wagsta, Jr. COAST Laboratory Purdue University West Lafayette, IN COAST TR-98/01 Abstract In this paper, we show that the compressions functions of SHA, MD, MD4 and MD5 are not ane transformations of their inputs. 1 Introduction The Secure Hash Algorithm (SHA) [1, 5, ] and the Message Digest algorithms MD [4], MD4 [6] and MD5 [7], are used to produce a message digest, a condensed form of a message for use in digital signature and other applications. Figure 1 shows how these algorithms are used. Each step in each of the algorithms is a compression function (denoted by CF in the gure) which takes as inputs a (portion of a) message and the current value for a chaining variable. Each compression function alters the value for the chaining variable based on the input message, and the output from each compression function is this altered value for the chaining variable. The value for the chaining variable from the last application of the compression function is the output message digest. The initial value for the chaining variable for the rst application of the compression function is xed for each algorithm and each subsequent application uses the output from the previous application as input value for the chaining variable. An important property for each such compression function to possess is for the output to not be an ane transformation of the inputs, which are a xed size (portion of a) message and the initial value for the chaining variable. If the output from a compression function is an ane transformation of its inputs, it would be trivial to construct messages that produce a given message digest when subjected to the message digest algorithm as we show in section 1.. Such an algorithm would be useless in a security context. In this paper we show that the compressions functions of the message digest algorithms SHA, MD, MD4 and MD5 as described in [1], [4], [6] and [7] respectively are indeed not ane. 1.1 Some Characteristics of the Algorithms Each algorithm takes an arbitrary length (we use \length", \size" and \number of bits" to mean the same unless specically noted otherwise) message as input and produces a xed length message digest as output. The message digest is 160 bits for SHA and 18 bits for each of MD, MD4 and MD5. Each algorithm pads the input message such astomake the number of bits in the message plus the padamultiple of 51 in the case of SHA, MD4 and MD5, and a multiple of 18 in the case of MD. Portions of this work were supported by sponsors of the COAST Laboratory. 1

2 Message Pad M M M M M L L L L L Initial Default CF CF CF CF CF Value for Chaining Variable L Final Digest M = 51 bits for SHA, MD{4,5} M = 18 bits for MD L = 160 bits for SHA L = 18 bits for MD{,4,5} Figure 1: Use of Message Digest Algorithms For SHA, MD4 and MD5, the padding consists of a 1 (bit) followed by enough 0's to make the number of bits of the message plus the pad (so far) 448 mod 51. At least 1 bit and at most 51 bits are thus added as pad. The length of the (original) message represented as a 64 bit number is then appended to make the entire length a multiple of 51. In the case of MD, padding of sucient length to make the number of bits of the padded message a multiple of 18 is added. Thus, if i bytes are added as pad, each of those bytes has the value i. At least 1 byte and at most 16 bytes are appended as pad. A 16 byte (18 bit) checksum of the message plus pad is also then appended. After padding, SHA, MD4 and MD5 break the padded message into 51 bit chunks and use those as inputs to the compression function, in turn, as indicated in gure 1. MD also does the same, except that its compression function takes 18 bit chunks of the message as input. Each compression function also takes as input the value of the chaining variable which is the output from the previous application of the compression function. For the rst application of the compression function, each algorithm uses a default initial value for the chaining variable. 1. An Attack on a Message Digest Algorithm That Uses an Ane Compression Function In this section, we assume the existence of a message digest algorithm, A that works like SHA, MD, MD4 and MD5 in that it takes as input a message of some length, pads the message and breaks the padded message into equal sized chunks to use as input to a compression function, CF. CF also takes as input a chaining variable that is the output from the previous application of CF (a default value for the rst application). Also, we assume that CF is ane in its inputs, that is, CF can be represented as a pre-multiplication by a matrix of appropriate dimensions bitwise XOR-ed with a vector of appropriate size. Then, given a message and its corresponding message digest, we construct a second message with the same message digest. We assume that the reader is familiar with basic concepts of numerical linear algebra such asrank of a matrix and Gaussian Elimination. We refer the reader to [] for a review of these and other related topics. Also, we adopt the following notation: F n;m : The set of n m matrices each of whose elements are in F, the Galois Field with the two elements 0 and 1. m is omitted if it is 1, and n and m are omitted if they are both 1. : The (bitwise) exclusive-or operator. jj: A function that takes as argument a bit string or bit vector and returns its length. : Used to concatenate bit strings.

3 A: The message digest algorithm with an ane compression function. M; M 0 ;M 00 : Inputs to A (messages of some length). D: Output from A (message digest). CF: The compression function used in A. m; m i : Input message to CF,typically a portion of M, M 0 or M 00, written as a bit vector. v; v i : Input chaining variable to CF written as a bit vector. w; w i : Output from CF written as a bit vector. The output from the nal application of CF is the message digest. L m : The length of the input message to CF. Thus, typically, L m = jm i j and L m = 51 for SHA, MD4 and MD5 and L m = 18 for MD. L v : The length of the input chaining variable to and thus, the output from, CF. Thus, L v = jv i j = jw j j for any i; j. L v = 160 for SHA and L v = 18 for MD, MD4 and MD5. p: The padding added to the message. For SHA, MD4 and MD5, 65 jpj 576 and for MD, 16 jpj 56. C: The matrix corresponding to CF. Thus, C F Lv;(Lv+Lm). C i : The i th column of C, where 1 i (L v + L m ). Thus, C i F Lv and C = C1 C ::: C (Lv+Lm). b: The constant vector corresponding to the ane transformation, CF. Thus, b is the output on input 0 (the vector of all 0's), and b F Lv. Thus, CF, on inputs v, m and output w can now be expressed as: w = C 1 C ::: C (Lv+Lm) v m b (1) Assume that some message M on input to A produces D as message digest. We would like to substitute our favorite message, M 0 for the original message, but have the new message also produce the same output D on input to A. Of course, this is not possible in general. Therefore, starting from our favorite message M 0,we construct M 00, a slightly transformed version of M 0, such that M 00 on input to A, produces D as message digest. Starting with M 0,we carry out the attack as follows. 1. We split M 0 into chunks of size L m. Thus, we produce m 1 ;m ;:::;m k such that jm i j = L m for i =1; ;:::;k, 1, jm k jl m and m 1 m ::: m k = M 0.. We subject each ofm 1 ;m ;:::;m k,1 to CF, in turn. At the rst application, we use the default value for the input chaining variable and at each subsequent application, we use the output from the previous application of CF. Application of CF is carried out as indicated in (1). The output from the last such application of CF is w k,1 = v k, which is the same as the input chaining variable to the next application of CF. Thus, we have now performed k, 1 applications of CF.. If A works like SHA, MD4 or MD5, the message is rst padded with at least one bit so that it is of length 448 mod L m, and then with the length of the message represented as a 64 bit number (of course, L m = 51 for SHA, MD4 and MD5). Our strategy is to append a suitable \noise" to the message. We now need to consider one of several cases as described below. (a) If the next (k th ) application of CF is to be the last, we require the output from the application to be D. Thus, we need to nd a \noise" n such that: v k 6 m C1 C ::: C 6 k (Lv+Lm) 4 n p = D b ()

4 To be able to nd such an n, we need the following condition to be satised: rank, C (Lv+jmkj+1) C (Lv+jmkj+) ::: C (Lv+Lm,jpj) = rank(c) () We may assume that p is of minimum length, that is jpj = 65. If () is true, we are left with a consistent system of linear equations in the components (bits) of n, for any D. That is, if n = n 1 n ::: n t T, where t =(Lm,jm k j,jpj) and each n i F, i =1; ;:::;t, then () can be rewritten as: n 1 C (Lv+jmkj+1) n C (Lv+jmkj+) ::: n t C (Lv+Lm,jpj) =,, D b C1 C ::: C Lv vk C(Lv+1) C (Lv+) ::: C (Lv+jmkj) mk, C(Lv+Lm,jpj+1) C (Lv+Lm,jpj+) ::: C (Lv+Lm) p (4) We now pick rank(c) non-trivial equations in n 1 ;n ;:::;n t from (4) and solve them using Gaussian Elimination. Note that we are guaranteed that the system of equations (4) will be consistent because of (). If rank(c) < jnj, then jnj,rank(c) ofn 1 ;n ;:::;n t are chosen arbitrarily. (b) If () cannot be satised (perhaps because jnj is too small), we rst pick an arbitrary \noise" n of length L m,jm k j and compute: w k = v k+1 = C 4 v k m k n Now, we attempt to nd an additional \noise" n 0 such that: C1 C ::: C 4 (Lv+Lm) 5 b (5) v k+1 n 0 p 5 = D b (6) Again, we may assume that p is of minimum length. For n 0 in (6) to be found, we need for the following condition to hold: rank, C (Lv+1) C (Lv+) ::: C (Lv+Lm,jpj) = rank(c) (7) If the condition (7) is satised, n 0 can be computed by solving the system of linear equations suggested by (6), similar to the previous case. (c) If (7) cannot be satised, we rst choose some n with jnj = L m,jm k j and compute w k = v k+1 as indicated in (5). Similar to the previous case, we seek to incorporate additional \noise" n 0 and n 00 with jn 0 j = L m and jn 00 j = L m,jpj such that: C vk+1 n 0 = w k+1 b = v k+ b C 4 v k+ n 00 p 5 = D b (8) For us to be able to nd appropriate n 0 and n 00,we require the following to be true: rank, C 1 ::: C (Lv+Lm,jpj) = rank, C(Lv+1) ::: C (Lv+Lm) = rank(c) (9) 4

5 (d) If (9) cannot be satised, this implies that some bits in D b depend solely on either the input chaining variable or the last few bits that correspond to the padding p in the last application of CF. For the bits in Db that are a function of only the input chaining variable, all we need to make sure is that M 00 involves the same number of applications of CF as M in producing a message digest, that is, jm 00 + paddingj = jm + paddingj. Similarly, for the bits in D b that are a function of the padding, we only need to make sure that the padding added for M 00 is the same as that for M, which will be the case if jm 00 j = jm j. This restricts our choices for M 0, from which M 00 is constructed. Note that the condition jm 00 j = jm j is sucient, but not necessary. Thus, if A is similar to SHA, MD4 or MD5, we have shown how to construct a new message M 00 that results in the same message digest D as a given message M. 4. The cases for when A works like MD are similar. Thus, we have shown that a message digest algorithm that employs a compression function that is ane in its inputs can be easily subverted. In the next section, we conrm that fortunately, the widely used message digest algorithms SHA, MD, MD4 and MD5 do not employ compression functions that are ane in their inputs. The Compression Functions of SHA, MD, MD4 and MD5 are not Ane The input to each compression function can be perceived as a (bit) vector that is the member of a vector space of dimension L v + L m, where L m = 51 for SHA, MD4 and MD5, L m = 18 for MD, L v = 160 for SHA and L v = 18 for MD, MD4 and MD5. The output of the compression function is a member of a vector space of dimension L v.we show that each compression function, CF, is not an ane transformation by picking three inputs x 1 ;x ;x such that the property CF(x 1 ) CF(x ) CF(x )= CF(x 1 x x ) is violated. Appendix A shows such sets of three inputs for each of the algorithms. Since that property must hold for a transformation to be ane, and since we can nd x 1 ;x ;x that violate that property for each of the compression functions of SHA, MD, MD4 and MD5, we have proved the following theorem. Theorem.1 The compression functions of SHA, MD, MD4 and MD5 are not ane. References [1] Proposed Federal Information Processing Standard for Secure Hash Standard. Federal Register, 57(1), January 199. [] Proposed Revision of Federal Information Processing Standard (FIPS) 180, Secure Hash Standard. Federal Register, 59(11), July [] Gene H. Golub and Charles F. Van Loan. Matrix Computations. The Johns Hopkins University Press, second edition, [4] B. Kaliski. RFC-119 The MD Message-Digest Algorithm. Network Working Group, April 199. [5] National Institute of Standards and Technology. NIST FIPS PUB 180, Secure Hash Standard. U.S. Department of Commerce, May [6] R. Rivest. RFC-10 The MD4 Message-Digest Algorithm. Network Working Group, April 199. [7] R. Rivest. RFC-11 The MD5 Message-Digest Algorithm. Network Working Group, April

6 A Inputs to the Compression Functions that Show that they are not Ane This section lists the sets of inputs x 1 ;x ;x for each of the compression functions, CF, of SHA, MD, MD4 and MD4 such that the property CF(x 1 ) CF(x ) CF(x )=CF(x 1 x x ) is violated. Note that each x i is 67 bits (twenty one -bit words) for SHA, 56 bits (eight -bit words) for MD, and 640 bits (twenty -bit words) for MD4 and MD5. SHA: MD: MD4: 0x17FC1BE 0x0B46E0A5 0x680F780 0x0AC1A10 0x0CEF56F 0x71CAB 0x04D7CFC0 0x0E1091E6 0x1E8DA0C 0xE6670E6 0x1441E48 0x40A48 0x09878EA 0x5CB95 0xD4065A1 0xAB668 0x1DA8F1A 0x041E7F1 0xFFDB 0x001AA0 0xF8A7F6 0x097911B 0x06F1B 0x1E8796E5 0x55FCC7 0x49B588C 0x1A11C15C 0x746DB51 0x7ABBF8 0x780BAC 0x4B8910E 0x008FCB 0xD05EF 0x09415E 0x5C76A6 0x0CAF851 0x01A5F7 0xD6B5DE9 0xF xD6DF1 0x x00ADA04F 0x0E9AF8AF 0x0EA x0690 0x144AC8F 0x5F48C17 0xE4694B 0x419BD 0x1C99BC4 0x5AAF55 0x0A5501D9 0x11875EA 0x5F86 0x1A7A790B 0xE985 0x0D6E56B 0x1C9B966 0x xEAEB10F 0x8B758B 0x98BF674 0x4E17DB4 0x1A87D98 0x16D19D6 0x17CF5CF4 0x0114CC 0x0468A4 0x0A456E11 0xF766D 0x0C81184A 0x06811F 0x0D779C0 0x65F05B 0x x1A9EE15 0x1DD7BE 0x1CC6CBD 0xD7DBF9 0x06695EDD 0x097700F1 0x5118 0x6FDFB57 0x7671FA 0x0966DCB 0x0DDE6C 0x0F446B76 0xA x1DB19C8C 0xAA1090E 0xEFB8011 0x4105FBE 0x0155AB 0xA78FC 0xD9E0908 0x45558D6 0xCB7CCA 0x080E10E9 0x9E11EF 0xCF89D1 0x180E0 0xE5ED 0x16AED0 0x0D61F5 0x0ADC17 0x154 0x168F0EF 0x0C76AA54 0xE5B8FA 0x0FDF95 0x17E04A 0x0A5A79A 0x4F0447 0x8DBFA9 0x81DE716 0xAD8A6 0xD6C7 0xBF5AC70 0x1FDD5D41 0x0D1A81 0x01F959ED 0x06FB065 0x68D75 0x1DA x671A5B 0x096560E 0x0E0EB09 0x1EA8 0xD978C5C 0x5CB81 0x699A5A0 0x06557EE 0x1CD9C56A 0x0FBDDB 0xA96EB87 0x01E9ED4D 0xA6A45A8 6

7 MD5: 0x1F5AA8C9 0x0160AC9 0xCEA1 0xC4166 0x17DF601 0x1EC1FC5D 0x114DB9 0x0C905AA1 0x7A4BC8 0x0F91D5A5 0x7BECA4 0x0F00C1 0x048888EF 0x1E8BA477 0x1B0DA6 0x1C8DD10 0x005C00A 0x17F9A0 0x1F844CD 0x0AD7B7 0x1814CEB 0x05489ABA 0xA90 0x5BAD080 0x08E x01E89AC 0x00C14D98 0x06F4F74D 0x15EAD09B 0x8A467 0x07E9045 0x194B69F 0xB7B6D 0x71FE78 0x10CFFB 0x089B7991 0x0D6F8A6 0x17BC6B 0x09E41B5 0x15ED6DB 0x0D x4D x1E454DAC 0x8B6485 0xA6A175 0xDCB096 0xD7056 0xA58B65 0x0D8854 0x07E5698F 0x195EB8A4 0x8BBDBA0 0x51C0FD 0x1FD19FB8 0x0614B4C1 0x10D4A 0x1AA161B 0xFE99FD7 0xB899B98 0x180CD49 0x05795DB6 0x1EEC7B8F 0x1D4494D 0x90FE0DB 0x0EDA88F 0x16BD5ADC 0x0F9F9DC1 0x0AC8DC 0xAEF0B6 0x86B99 7

Keywords: CRC, CRC-7, cyclic redundancy check, industrial output, PLC, programmable logic controller, C code, CRC generation, microprocessor, switch

Keywords: CRC, CRC-7, cyclic redundancy check, industrial output, PLC, programmable logic controller, C code, CRC generation, microprocessor, switch APPLICATION NOTE 6002 CRC PROGRAMMING FOR THE MAX14900E